chore: add concurrency groups and check head commit's sha didn't change before publishing

.github/workflows/build-images.yml

@@ -24,6 +24,10 @@ on:
       pull-password:
         required: true
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     name: ${{ matrix.version }}${{ matrix.flavor }} (${{ matrix.arch }})

.github/workflows/publish-images.yml

@@ -3,6 +3,8 @@ name: Publish images
 # Publishes the images built and tested by the triggering build-images.yml run: merges each
 # image's per-arch digests into a multi-arch tag on ghcr, then copies it to Docker Hub. Nothing is
 # rebuilt, and nothing is read from Docker Hub, so publishing doesn't count against its pull limits.
+# Callers must skip runs whose commit is no longer the head of main (github.sha), so an older
+# commit whose tests finished late can't overwrite the tags of a newer one.
 
 on:
   workflow_call:
@@ -25,6 +27,10 @@ on:
       push-password:
         required: true
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   publish:
     name: ${{ matrix.version }}${{ matrix.flavor }}

.github/workflows/publish.5.yml

@@ -9,7 +9,7 @@ on:
 jobs:
   publish-5:
     name: Publish PHP 5 images
-    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && !contains(github.event.workflow_run.head_commit.message, '[skip ci]') && !contains(github.event.workflow_run.head_commit.message, '[ci skip]') }}
+    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && github.event.workflow_run.head_sha == github.sha }}
     permissions:
       actions: read
       contents: read

.github/workflows/publish.7.yml

@@ -9,7 +9,7 @@ on:
 jobs:
   publish-7:
     name: Publish PHP 7 images
-    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && !contains(github.event.workflow_run.head_commit.message, '[skip ci]') && !contains(github.event.workflow_run.head_commit.message, '[ci skip]') }}
+    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && github.event.workflow_run.head_sha == github.sha }}
     permissions:
       actions: read
       contents: read

.github/workflows/publish.8.yml

@@ -9,7 +9,7 @@ on:
 jobs:
   publish-8:
     name: Publish PHP 8 images
-    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && !contains(github.event.workflow_run.head_commit.message, '[skip ci]') && !contains(github.event.workflow_run.head_commit.message, '[ci skip]') }}
+    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && github.event.workflow_run.head_sha == github.sha }}
     permissions:
       actions: read
       contents: read

.github/workflows/publish.compat.yml

@@ -6,11 +6,17 @@ on:
     branches: [main]
     types: [completed]
 
+# Every completed test run starts this workflow; runs that won't publish get their own group, so
+# they can't cancel a publish in progress.
+concurrency:
+  group: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && github.event.workflow_run.head_sha == github.sha && github.workflow || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   publish-compat:
     name: Build and publish compatibility images
     runs-on: ubuntu-22.04
-    if: ${{ github.event.workflow_run.conclusion == 'success' && !contains(github.event.commits[0].message, '[skip ci]') && !contains(github.event.commits[0].message, '[ci skip]') }}
+    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && github.event.workflow_run.head_sha == github.sha }}
     strategy:
       fail-fast: false
       matrix:

.github/workflows/publish.latest.yml

@@ -9,7 +9,7 @@ on:
 jobs:
   publish-latest:
     name: Publish latest PHP images
-    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && !contains(github.event.workflow_run.head_commit.message, '[skip ci]') && !contains(github.event.workflow_run.head_commit.message, '[ci skip]') }}
+    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && github.event.workflow_run.head_sha == github.sha }}
     permissions:
       actions: read
       contents: read

.github/workflows/test.5.yml

@@ -12,7 +12,6 @@ on:
 jobs:
   test-5:
     name: Build and test PHP 5 images
-    if: ${{ !contains(github.event.commits[0].message, '[skip ci]') && !contains(github.event.commits[0].message, '[ci skip]') }}
     permissions:
       contents: read
       packages: write

.github/workflows/test.7.yml

@@ -12,7 +12,6 @@ on:
 jobs:
   test-7:
     name: Build and test PHP 7 images
-    if: ${{ !contains(github.event.commits[0].message, '[skip ci]') && !contains(github.event.commits[0].message, '[ci skip]') }}
     permissions:
       contents: read
       packages: write

.github/workflows/test.8.yml

@@ -12,7 +12,6 @@ on:
 jobs:
   test-8:
     name: Build and test PHP 8 images
-    if: ${{ !contains(github.event.commits[0].message, '[skip ci]') && !contains(github.event.commits[0].message, '[ci skip]') }}
     permissions:
       contents: read
       packages: write

.github/workflows/test.compat.yml

@@ -9,11 +9,14 @@ on:
   pull_request:
     types: [opened, synchronize]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   test-compat:
     name: Build and test compatibility images
     runs-on: ubuntu-22.04
-    if: ${{ !contains(github.event.commits[0].message, '[skip ci]') && !contains(github.event.commits[0].message, '[ci skip]') }}
     strategy:
       fail-fast: false
       matrix:

.github/workflows/test.latest.yml

@@ -12,7 +12,6 @@ on:
 jobs:
   test-latest:
     name: Build and test latest PHP images
-    if: ${{ !contains(github.event.commits[0].message, '[skip ci]') && !contains(github.event.commits[0].message, '[ci skip]') }}
     permissions:
       contents: read
       packages: write